Lightweight homomorphic encryption method for implementing symmetric and asymmetric encryption

Abstract

The present invention discloses a lightweight homomorphic encryption method for realizing symmetric encryption and asymmetric encryption. The method comprises: determining a private key and a first public parameter according to a private key parameter, wherein the private key parameter, the private key and the first public parameter are all integers; performing symmetric encryption on plaintext data according to the private key and the first public parameter through a first encryption model to obtain ciphertext data corresponding to the plaintext data, or performing asymmetric encryption on the plaintext data through a second encryption model based on a public key and the first public parameter to obtain ciphertext data; performing homomorphic operation on the data to be operated to obtain homomorphic encrypted data. According to the method provided by the present invention, mixed homomorphic operation can be realized; since the present invention can directly perform homomorphic operation on ciphertext data, the efficiency of homomorphic operation can be realized; since the present invention only involves operations on integers, the computing cost can be reduced, thereby realizing efficient and lightweight encryption, homomorphic operation and decryption.

Description

Technical Field

[0001] The present invention belongs to the technical field of data encryption and particularly relates to a lightweight homomorphic encryption method for realizing symmetric encryption and asymmetric encryption. Background Art

[0002] With the public's increasing attention to personal privacy and the protection of privacy data by domestic and foreign legislation, data security and privacy protection have become key research topics to promote the healthy development of the digital economy. In particular, the rise and popularity of cloud computing has led data owners to tend to outsource private data to cloud servers to reduce local storage and computing costs. Since cloud servers are usually operated by third parties, data encryption technology is introduced to protect data confidentiality, that is, data owners encrypt private data and then outsource the ciphertext data to cloud servers. However, ciphertext data has been fully randomized, making it difficult to perform data analysis and value mining based on ciphertext, so the introduction of encryption technology greatly reduces the availability of data. The emergence of homomorphic encryption schemes has well solved the dilemma of data confidentiality and data availability, allowing data to be operated in a secret state, thereby realizing data analysis and data mining based on ciphertext.

[0003] In 2009, Gentry first proposed a homomorphic encryption scheme based on an ideal lattice in his doctoral thesis, which marked the beginning of homomorphic encryption research. In the early days, homomorphic encryption based on an ideal lattice had serious performance issues, and its public key took more than 2 hours to build. After that, researchers successively launched homomorphic encryption schemes such as BGV (Brakerski-Gentry-Vaikuntanathan), GSW (Gentry-Sahai-Waters), and CKKS (Cheon-Kim-Kim-Song), but these schemes have performance issues due to their complex calculations and cannot be truly applied to real scenarios, especially scenarios with strict requirements on data calculation speed.

[0004] In addition to the above-mentioned homomorphic construction schemes based on LWE (Learning with Errors) or RLWE (Ring-Learning with Errors), lightweight homomorphic encryption schemes based on modular operations have been proposed: the patent "A homomorphic encryption algorithm based on modular operations" (application publication number: CN108111295A) only describes the encryption and decryption algorithms of the constructed homomorphic scheme, and does not explain the homomorphic operations, including addition homomorphism and multiplication homomorphic algorithms, so the rationality and efficiency of its homomorphic operations are still unclear; the patent "A lightweight homomorphic encryption method for privacy protection in cloud computing" (application publication number: CN1093273 04A) only supports additive homomorphism, not multiplicative homomorphism; the patent "A fully homomorphic encryption algorithm suitable for high-speed computing" (application publication number: CN113420314A) can support additive and multiplicative homomorphism, but it constructs two ciphertexts for additive homomorphism and multiplicative homomorphism respectively, which cannot support complex operations, such as those involving addition and multiplication operations at the same time; the patent "A fully homomorphic encryption processing method based on modular operation" (application publication number: CN106452723A) splits the data into corresponding bases, and then uses modular operations for data encryption. Because this method requires data splitting, such as when integers are split into binary, the number of ciphertexts and the number of homomorphic operations will expand exponentially, resulting in low efficiency. Moreover, the multiplicative homomorphism of this method is based on matrix operations, which greatly increases the computational cost.

[0005] Therefore, current homomorphic encryption methods are either inefficient and difficult to use in production environments, or have high computational costs, or only support certain homomorphic operations and cannot implement mixed operations, and none of the above encryption methods can support symmetric encryption and asymmetric encryption at the same time. Summary of the invention

[0006] The embodiments of the present invention provide a lightweight homomorphic encryption method for implementing symmetric encryption and asymmetric encryption, which can solve the problems of high computational cost and low processing efficiency of current homomorphic encryption methods and the inability to support both symmetric encryption and asymmetric encryption at the same time.

[0007] In a first aspect, an embodiment of the present invention provides a lightweight homomorphic encryption method for implementing symmetric encryption and asymmetric encryption, the method comprising:

[0008] Determine a private key and a first public parameter according to the private key parameter, wherein the private key parameter, the private key and the first public parameter are all integers;

[0009] Based on the private key and the first public parameter, the plaintext data is symmetrically encrypted using a first encryption model to obtain ciphertext data corresponding to the plaintext data;

[0010] or performing asymmetrical encryption on the plaintext data through a second encryption model based on the public key and the first public parameter to obtain ciphertext data;

[0011] Performing homomorphic operation on the data to be operated to obtain homomorphically encrypted data, wherein the data to be operated includes one or more of the following: ciphertext data, plaintext data, homomorphic encrypted data obtained before performing this homomorphic calculation, the homomorphic operation includes addition operation and / or multiplication operation, and decrypting the homomorphic encrypted data can obtain homomorphic decrypted data, which is the result of performing homomorphic operation on the plaintext data corresponding to the data to be operated.

[0012] According to the method provided by the present invention, plaintext data is encrypted by the first encryption model or the second encryption model to obtain ciphertext data, and the homomorphic encrypted data can be decrypted to obtain the corresponding plaintext data after the homomorphic operation is performed, thereby realizing mixed homomorphic operation; since the present invention can directly perform homomorphic operation on ciphertext data and plaintext data, it is not necessary to realize homomorphic operation through complicated operation process, so the high efficiency of homomorphic operation can be realized; since the present invention only involves multiplication, addition and modular operation on integers, compared with matrix, data splitting and other operations of other schemes, it can reduce the computing cost, thereby realizing efficient and lightweight encryption, homomorphic operation and decryption.

[0013] In a possible implementation manner of the first aspect, the first encryption model may satisfy the following formula:

[0014] E(m)=s·(r·L+m)(1+r′·p)mod N

[0015] Among them, m is the ciphertext data, E(m) is the plaintext data, r is the first random number, r′ is the second random number, s is the first private key, L is the second private key, p is the third private key, N is the first public parameter, and mod is the modular operation.

[0016] In a possible implementation manner of the first aspect, the private key parameters may include: a first length parameter k0 and a second length parameter k L A prime number whose bit length is the first length parameter k0 can be randomly selected to obtain a first integer; a prime number whose bit length is the first length parameter k0 can be randomly selected to obtain a third private key; the product of the first integer and the third private key is determined as the first public parameter; an integer can be randomly selected to obtain the first private key.

[0017] Exemplarily, the bit length of the first private key is the same as the first public parameter, and the first private key is smaller than the first public parameter.

[0018] In a possible implementation manner of the first aspect, plaintext data may be input into a first encryption model to symmetrically encrypt the plaintext data to obtain ciphertext data.

[0019] In a possible implementation of the first aspect, the public key may include a first public key, a second public key, and a third public key. Two 0s may be input into the first encryption model to obtain the first public key and the second public key, respectively; and 1 may be input into the first encryption model to obtain the third public key.

[0020] In a possible implementation manner of the first aspect, the second encryption model may satisfy the following formula:

[0021] E(m)=(m·E(1)+r1·E(0)1+r2·E(0)2)mod N

[0022] Among them, m is plaintext data, E(m) is ciphertext data, E(0)1 is the first public key, E(0)2 is the second public key, E(1) is the third public key, N is the first public parameter, and r1 and r2 are two random numbers.

[0023] In a possible implementation of the first aspect, a private key and homomorphically encrypted data may also be sent to a receiving end, so that the receiving end decrypts the homomorphically encrypted data through a first decryption model according to the private key and the first public parameter to obtain homomorphically decrypted data.

[0024] Exemplarily, the first decryption model satisfies the following formula:

[0025] m′=(((s d ) -1 E(m)mod N)mod p)mod L

[0026]

[0027] Where m is the homomorphic decrypted data, E(m) is the homomorphic encrypted data, r is the first random number, r′ is the second random number, s is the first private key, L is the second private key, p is the third private key, N is the first public parameter, (s d ) -1 For d The inverse element of , d is the exponent of the first private key.

[0028] In a possible implementation of the first aspect, if the homomorphic operation includes an addition operation, the exponent of the first private key of the homomorphically encrypted data is the maximum exponent of the first private keys of all summed items; if the homomorphic operation only includes a multiplication operation, the exponent of the first private key of the homomorphically encrypted data is the sum of the exponents of the first private keys of all multiplied data to be operated.

[0029] According to the method provided by the present invention, the plaintext data is encrypted by the first encryption model or the second encryption model to obtain the ciphertext data, and the homomorphic encrypted data can be decrypted to obtain the corresponding plaintext data after the homomorphic operation is performed, so as to realize the mixed homomorphic operation; since the present invention can directly perform homomorphic operation on the ciphertext data and the plaintext data, it is not necessary to realize the homomorphic operation through a complex operation process, so the efficiency of the homomorphic operation can be realized; since the present invention only involves multiplication, addition and modular operation on integers, compared with the matrix, data splitting and other operations of other schemes, the calculation cost can be reduced, thereby realizing efficient and lightweight encryption, homomorphic operation and decryption. Further, only one additional inverse operation is required for decryption. Since the first private key is fixed, the decryptor can calculate the relevant inverse element of the first private key in advance, which is equivalent to only involving one multiplication and three modular operations, which can simplify the operation process and improve the efficiency of data processing. At the same time, the method provided by the present invention can realize both symmetric encryption and asymmetric encryption, and can expand the application scenario.

[0030] In a second aspect, an embodiment of the present invention provides a lightweight homomorphic encryption device for implementing symmetric encryption and asymmetric encryption, the device comprising a processing unit; the processing unit is used to:

[0031] Determine a private key and a first public parameter according to the private key parameter, wherein the private key parameter, the private key and the first public parameter are all integers;

[0032] Based on the private key and the first public parameter, the plaintext data is symmetrically encrypted by a first encryption model to obtain ciphertext data corresponding to the plaintext data;

[0033] or performing asymmetrical encryption on the plaintext data through a second encryption model based on the public key and the first public parameter to obtain ciphertext data;

[0034] Performing homomorphic operation on the data to be operated to obtain homomorphically encrypted data, wherein the data to be operated includes one or more of the following: ciphertext data, plaintext data, homomorphic encrypted data obtained before performing this homomorphic calculation, the homomorphic operation includes addition operation and / or multiplication operation, and decrypting the homomorphic encrypted data can obtain homomorphic decrypted data, which is the result of performing homomorphic operation on the plaintext data corresponding to the data to be operated.

[0035] In a possible implementation manner of the second aspect, the first encryption model may satisfy the following formula:

[0036] E(m)=s·(r·L+m)(1+r′·p)mod N

[0037] Among them, m is plaintext data, E(m) is ciphertext data, r is the first random number, r′ is the second random number, s is the first private key, L is the second private key, p is the third private key, N is the first public parameter, and mod is the modular operation.

[0038] In a possible implementation manner of the second aspect, the private key parameters may include: a first length parameter k0 and a second length parameter k L The processing unit can be specifically used to randomly select a prime number whose bit length is the first length parameter k0 to obtain a first integer; randomly select a prime number whose bit length is the first length parameter k0 to obtain a third private key; determine the product of the first integer and the third private key as the first public parameter; and randomly select an integer to obtain the first private key.

[0039] Exemplarily, the bit length of the first private key is the same as the first public parameter, and the first private key is smaller than the first public parameter.

[0040] In a possible implementation of the second aspect, the public key may include a first public key, a second public key and a third public key, and the processing unit may also be used to input two 0s into the first encryption model respectively to obtain the first public key and the second public key; and input 1 into the first encryption model to obtain the third public key.

[0041] In a possible implementation manner of the second aspect, the second encryption model may satisfy the following formula:

[0042] E(m)=(m·E(1)+r1·E(0)1+r2·E(0)2)mod N

[0043] Among them, m is plaintext data, E(m) is ciphertext data, E(0)1 is the first public key, E(0)2 is the second public key, E(1) is the third public key, N is the first public parameter, and r1 and r2 are two random numbers.

[0044] In a possible implementation of the second aspect, the device may further include a sending unit. The sending unit may be used to send a private key and homomorphically encrypted data to a receiving end, so that the receiving end decrypts the homomorphically encrypted data through a first decryption model according to the private key and the first public parameter to obtain homomorphically decrypted data.

[0045] Exemplarily, the first decryption model satisfies the following formula:

[0046] m′=(((s d ) -1 E(m)mod N)mod p)mod L

[0047]

[0048] Where m is the homomorphic decrypted data, E(m) is the homomorphic encrypted data, r is the first random number, r′ is the second random number, s is the first private key, L is the second private key, p is the third private key, N is the first public parameter, (s d ) -1 For d The inverse element of , d is the exponent of the first private key.

[0049] In a possible implementation of the second aspect, if the homomorphic operation includes an addition operation, the exponent of the first private key of the homomorphically encrypted data is the maximum exponent of the first private keys of all summed items; if the homomorphic operation only includes a multiplication operation, the exponent of the first private key of the homomorphically encrypted data is the sum of the exponents of the first private keys of all multiplied data to be operated.

[0050] In a third aspect, an embodiment of the present invention provides an electronic device, comprising a processor and a memory, wherein the memory is used to store computer programs; the processor can be used to execute the computer program (instructions) stored in the memory to implement the method of the first aspect above.

[0051] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed, the method of the first aspect described above can be implemented.

[0052] It can be understood that the beneficial effects of the second to fourth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here.

[0053] Compared with the prior art, the embodiments of the present invention have the following beneficial effects: according to the method provided by the present invention, plaintext data is encrypted by the first encryption model or the second encryption model to obtain ciphertext data, and the homomorphic encrypted data can be decrypted to obtain the corresponding plaintext data after the homomorphic operation is performed, thereby realizing mixed homomorphic operation; since the present invention can directly perform homomorphic operation on ciphertext data and plaintext data, it is not necessary to realize homomorphic operation through complex operation process, so the high efficiency of homomorphic operation can be realized; since the present invention only involves multiplication, addition and modular operation on integers, compared with matrix, data splitting and other operations of other schemes, it can reduce the computing cost, thereby realizing efficient and lightweight encryption, homomorphic operation and decryption. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 A schematic diagram of a lightweight homomorphic encryption method for implementing symmetric encryption and asymmetric encryption provided by an embodiment of the present invention;

[0055] Figure 2 A schematic diagram of a lightweight homomorphic encryption method for implementing symmetric encryption and asymmetric encryption provided by an embodiment of the present invention;

[0056] Figure 3 A schematic diagram of a lightweight homomorphic encryption method for implementing symmetric encryption and asymmetric encryption provided by an embodiment of the present invention;

[0057] Figure 4 A schematic diagram of the structure of a lightweight homomorphic encryption device for implementing symmetric encryption and asymmetric encryption provided by an embodiment of the present invention;

[0058] Figure 5 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0059] The present invention is further described in detail below with reference to specific embodiments, but the embodiments of the present invention are not limited thereto.

[0060] The lightweight encryption method provided by the embodiment of the present invention can be applied to electronic devices such as mobile terminals, personal laptops, supercomputers, etc. The embodiment of the present invention does not impose any restrictions on the specific type of electronic devices.

[0061] Figure 1 The schematic flowchart of a lightweight homomorphic encryption method for implementing symmetric encryption and asymmetric encryption provided by an embodiment of the present invention is shown. Method 100 can be applied to the above-mentioned electronic device to implement symmetric encryption of plaintext data. As an example but not a limitation, method 100 may include steps S101-S103. Each step is described below.

[0062] S101, determining a private key and a first public parameter according to a private key parameter.

[0063] Exemplarily, the private key sk may include a first private key, a second private key, and a third private key, that is, sk=(s, L, p).

[0064] Exemplarily, the first public parameter, the private key, and the private key parameter are all integers.

[0065] In a possible implementation, before determining the private key, the private key parameters {k0, k L ,k r ,k M}.

[0066] Exemplarily, the private key parameters satisfy: k M <k L =k r <k0。

[0067] Exemplarily, the private key parameters may include a first length parameter k0 and a second length parameter k L , and a third length parameter kr and the fourth length parameter k M .

[0068] Exemplarily, the third length parameter k r It can be used to determine the first random number and the second random number in the first encryption model.

[0069] Exemplarily, the fourth length parameter is not used to determine the private key, but is used to limit the length range of the plaintext data. That is, the bit length of the plaintext data in the plaintext space M is Before.

[0070] In a possible implementation, a prime number with a bit length equal to the first length parameter k0 can be randomly selected to obtain a first integer q; and then a prime number with a bit length equal to the first length parameter k0 can be randomly selected to obtain a third private key. The product of the first integer q and the third private key p is determined as the first public parameter N, that is, N = p·q. Then, an integer with the same bit length as the first public parameter is randomly selected to obtain the first private key, and an integer with a bit length equal to the second length parameter k is randomly selected to obtain the first private key. L An integer is used to obtain the second private key.

[0071] Exemplarily, the bit length of the first private key is the same as the first public parameter, and the first private key is smaller than the first public parameter.

[0072] Optionally, the first length parameter k0 and the third length parameter k r , the plaintext space M and the first public parameter N form a public parameter set pp = {k0, k r ,M,N}, are open to the public. The disclosure of public parameters will not affect the confidentiality of plaintext data and ciphertext data.

[0073] S102: Based on the private key and the first public parameter, the plaintext data is symmetrically encrypted using a first encryption model to obtain ciphertext data corresponding to the plaintext data.

[0074] Exemplarily, the plaintext data can be symmetrically encrypted using the first encryption model according to the private key and the first public parameter to obtain the ciphertext data corresponding to the plaintext data. At this time, the input of the first encryption model is the plaintext data and the private key sk belonging to the plaintext space, and the output of the first encryption model is the ciphertext data.

[0075] Exemplarily, the first encryption model may satisfy the following formula:

[0076] E(m)=s·(r·L+m)(1+r′·p)mod N

[0077] Among them, m is plaintext data, E(m) is ciphertext data, r is the first random number, r′ is the second random number, s is the first private key, L is the second private key, p is the third private key, N is the first public parameter, and mod is the modular operation.

[0078] For example, That is, the first random number is a randomly selected bit length equal to the third length parameter k r A random number, and each bit is either 0 or 1.

[0079] For example, That is, the second random number may be a randomly selected random number whose bit length is the first length parameter k0, and each bit is either 0 or 1.

[0080] In one example, the symmetric encryption algorithm can be formally defined as: (E(m), d) = symmetric encryption (m, sk). Where m is the plaintext data in the symmetric encryption, sk is the private key, E(m) is the ciphertext data in the symmetric encryption, and d is the exponent of the first private key.

[0081] Exemplarily, the exponent of the first private key of the ciphertext data is 1.

[0082] S103, performing homomorphic operation on the data to be operated to obtain homomorphic encrypted data.

[0083] Exemplarily, homomorphic operations may include addition operations and / or multiplication operations. Addition operations and / or multiplication operations may be directly performed on the ciphertext data and homomorphically encrypted data obtained according to the method provided by the present invention, which can simplify the calculation process and reduce the amount of calculation. Unlike the current homomorphic encryption method, it is necessary to perform a series of computationally expensive operations on the ciphertext data and the homomorphically encrypted data to achieve the effect of homomorphic operations.

[0084] Exemplarily, the data to be calculated may include one or more of the following: ciphertext data, plaintext data, and homomorphic encrypted data obtained before performing the homomorphic calculation.

[0085] Exemplarily, decrypting homomorphically encrypted data can obtain homomorphically decrypted data.

[0086] Exemplarily, the homomorphic decrypted data is the result of performing a homomorphic operation on the plaintext data corresponding to the data to be operated.

[0087] For example, after encrypting the plaintext data through the above steps, the ciphertext data E(m1) and E(m2) are obtained, and the data to be operated may include the ciphertext data E(m1) and E(m2). The following homomorphic operation is performed on the data to be operated: E(m1)+E(m2), and the homomorphic encrypted data E(m1)+E(m2) is obtained. Then, the homomorphic encrypted data is decrypted to obtain m1+m2, that is, the result of performing the homomorphic operation on the plaintext data corresponding to the two ciphertext data included in the data to be operated.

[0088] For example, the data to be operated may include plaintext data m1 and ciphertext data E(m2), and the following homomorphic operation is performed on the plaintext data m1 and the ciphertext data E(m2): m1+E(m2), and the homomorphic encrypted data m1+E(m2) is obtained. Then, decrypting the homomorphic encrypted data can obtain: m1+m2, that is, the result of performing the homomorphic operation on the plaintext data m2 corresponding to the ciphertext data E(m2) and the plaintext data m1.

[0089] For example, the following homomorphic operation is performed on the ciphertext data E(m1) and E(m2): E(m1)×E(m2), and the homomorphic encrypted data is obtained: E(m1)×E(m2). After decrypting the homomorphic encrypted data, m1×m2 can be obtained, that is, the result of the homomorphic operation on the plaintext data m1 and m2 corresponding to the ciphertext data E(m1) and E(m2).

[0090] For example, the following homomorphic operation is performed on the ciphertext data E(m1) and the plaintext data m2: E(m1)×m2, and the homomorphic encrypted data is obtained: E(m1)×m2. Then, the homomorphic encrypted data is decrypted to obtain m1×m2, that is, the result of the homomorphic operation performed on the plaintext data m1 and the plaintext data m2 corresponding to the ciphertext data E(m1).

[0091] For example, the following homomorphic operation can be performed on the ciphertext data E(m1) and the plaintext data m2: E(m1)×m2+E(m1)+m2, and the homomorphic encrypted data can be obtained: E(m1)×m2+E(m1)+m2. Then the homomorphic encrypted data can be decrypted to obtain m1×m2+m1+m2, that is, the result of the homomorphic operation performed on the plaintext data m1 and the plaintext data m2 corresponding to the ciphertext data E(m1).

[0092] For example, the data to be operated may include the previous homomorphically encrypted data E(m3) and the plaintext data m2 and the ciphertext data E(m2). The following homomorphic operation can be performed on the previous homomorphically encrypted data E(m3)=E(m1)×m2, and the plaintext data m2 and the ciphertext data E(m2): E(m3)+E(m2)+E(m3)×m2×E(m2) to obtain the homomorphic encrypted data of this homomorphic operation: E(m3)+E(m2)+E(m3)×m2×E(m2). Decrypting it can obtain: m1×m2+m2+(m1×m2)×m2×m2, that is, the plaintext data m1+m2 corresponding to the previous homomorphic encrypted data E(m3), the plaintext data m2 corresponding to the ciphertext data E(m2), and the result of the current homomorphic operation on the plaintext data m2.

[0093] In some embodiments, the homomorphic encrypted data obtained after the homomorphic operation can also be expressed as: (E(m), d), where E(m) is the homomorphic encrypted data obtained after the homomorphic operation and d is the exponent of the first private key in the homomorphic encrypted data.

[0094] In one possible implementation, the exponent of the first private key in the homomorphically encrypted data may be the maximum value among the exponents of the first private keys of all sums in the homomorphic operation.

[0095] For example, if E(m1) and E(m2) are homomorphic encrypted data obtained by the previous homomorphic operation, E(m3) and E(m4) are the ciphertext data corresponding to the plaintext data m3 and m4. The homomorphic encrypted data E(m5) = E(m1) × E(m2) + E(m1) × E(m3) + E(m4) × E(m3). The sums are E(m1) × E(m2), E(m1) × E(m3), and E(m4) × E(m3). Then the exponent of the first private key of E(m5) is the maximum value of the exponents of the first private key in the above three sums.

[0096] In an example, if a sum includes the multiplication of M encrypted data, the exponent of the first private key of the sum is the sum of the exponents of the first private keys of the M encrypted data.

[0097] For example, M=2,3,...

[0098] Exemplarily, the encrypted data includes ciphertext data and / or homomorphically encrypted data.

[0099] For example, in the first sum E(m1)×E(m2) in the above example, E(m1) and E(m2) are both homomorphic encrypted data obtained by the previous homomorphic operation, and the corresponding first private key exponents are d1 and d2 respectively, then the exponent of the first private key of the first sum is d1+d2. In the second sum E(m1)×E(m3) in the above example, E(m3) is the ciphertext data corresponding to the plaintext data m3, then the exponent of the first private key of the second sum should be d1+1. Similarly, the exponent of the first private key of the third sum E(m4)×E(m3) should be 1+1=2.

[0100] Specifically, when performing homomorphic operations on the data to be operated, if the exponents of the first private key of each sum item are not equal, it is necessary to multiply the sum item with a smaller exponent by an encrypted data obtained according to the plaintext data 1, so that the exponent of its first private key is the same as the maximum value in the sum item. This ensures that the correct homomorphic decrypted data can be obtained by decrypting the homomorphically encrypted data.

[0101] For example, the exponents of the first private key of the three sum items in the above example are: d1+d2, d1+1, 2. If: d1+d2>d1+1>2, the second sum item E(m1)×E(m3) needs to be multiplied by the encrypted data (E(1),|d1+d2-(d1+1)|)=(E(1),|d2-1|), that is, the encrypted data is obtained only based on E(1), and the exponent of its first private key is |d2-1|, and E(1) is the homomorphic encrypted data obtained by encrypting 1. Similarly, the third sum item E(m4)×E(m3) needs to be multiplied by the encrypted data (E(1),|d1+d2-2|).

[0102] Specifically, the plaintext multiplied by the encrypted data, such as m4 in m4×E(m3), should be greater than 0.

[0103] In another example, if a sum is a multiplication of encrypted data and non-encrypted data, the exponent of the first private key of the sum is the exponent of the first private key of the encrypted data. For example, if the ciphertext data and the plaintext data are multiplied: m4×E(m3), the exponent of the first private key of the sum is the same as the exponent of the ciphertext data E(m3), both of which are 1.

[0104] In another possible implementation, if the homomorphic operation only includes multiplication operations, the exponent of the first private key of the homomorphically encrypted data is the sum of the exponents of all the first private keys of all the multiplied data to be operated. For example, the homomorphically encrypted data is E(m1)×E(m2), E(m1) and E(m2) are both homomorphically encrypted data obtained by the previous homomorphic operation, and the exponents of the corresponding first private keys are d1 and d2 respectively, then the exponent of the first private key of the homomorphically encrypted data is d1+d2.

[0105] Optionally, method 100 may further include step S104.

[0106] S104, sending the private key and the homomorphically encrypted data to the receiving end, so that the receiving end decrypts the homomorphically encrypted data through the first decryption model according to the private key and the first public parameter to obtain the homomorphically decrypted data.

[0107] Exemplarily, the private key may be sent to the receiving end first, and then the ciphertext data may be sent to the receiving end. The receiving end may obtain the first public parameter from the public parameter set.

[0108] In one possible implementation, the receiving end may decrypt the homomorphically encrypted data after operation through the first decryption model according to the private key and the first public parameter to obtain homomorphically decrypted data.

[0109] Exemplarily, the first decryption model may satisfy the following formula:

[0110] m′=(((s d ) -1 E(m)mod N)mod p)mod L

[0111]

[0112] Where m is the homomorphic decrypted data; E(m) is the homomorphic encrypted data; r is the first random number; r′ is the second random number; s is the first private key; L is the second private key; p is the third private key; N is the first public parameter; (s d ) -1 Refers to d Regarding the inverse element modulo N, that is, if s d ·t≡1mod N, then (s d ) -1 =t; d is the exponent of the first private key.

[0113] Optionally, (s d ) -1 The value of .

[0114] In one example, the decryption algorithm can be formally represented as: m=decryption(E(m),sk,d), where m is homomorphically decrypted data and E(m) is homomorphically encrypted data.

[0115] For example, if k M =40, k L =k r

[0116] For example, the ciphertext data E(m1) and E(m2) are subjected to an addition homomorphic operation to obtain the homomorphically encrypted data E(m3), where E(m3)=E(m1)+E(m2)mod N=. Since this addition homomorphic operation does not include the multiplication before the encrypted data, d=1, (s d ) -1 =s -1=. Substituting the above parameters into the first encryption model can obtain the homomorphic decrypted data m3=8=m1+m2.

[0117] For example, the ciphertext data E(m1) and E(m2) are multiplied homomorphically to obtain the homomorphically encrypted data E(m4), E(m4) = E(m1)·E(m2)mod N =. This multiplication homomorphic operation includes the multiplication of 2 ciphertext data and ciphertext data, so d = 1 + 1 = 2. Calculate (s d ) -1 =(s 2 ) -1=, and substitute the above parameters into the first decryption model to obtain the homomorphic decryption parameters m4=15=m1·m2.

[0118] In another possible implementation, step S103 may not be performed, and homomorphic operation may be performed on the data to be operated. Then the ciphertext data may be directly sent to the receiving end, and the receiving end may directly decrypt the ciphertext data according to the first decryption model to obtain the plaintext data. In this case, d=1.

[0119] According to the method provided by the present invention, the plaintext data is encrypted by the first encryption model or the second encryption model to obtain the ciphertext data, and the homomorphic encrypted data can be decrypted to obtain the corresponding plaintext data after the homomorphic operation is performed, thereby realizing mixed homomorphic operation; since the present invention can directly perform homomorphic operation on the ciphertext data and the plaintext data, it is not necessary to realize the homomorphic operation through a complex operation process, so the efficiency of the homomorphic operation can be realized; since the present invention only involves multiplication, addition and modular operation on integers, compared with the matrix, data splitting and other operations of other schemes, the calculation cost can be reduced, thereby realizing efficient and lightweight encryption, homomorphic operation and decryption. Furthermore, only one additional inverse operation is required for decryption. Since the first private key is fixed, the decryptor can calculate the relevant inverse of the first private key in advance, which is equivalent to only involving one multiplication and three modular operations, which can simplify the operation process and improve the efficiency of data processing.

[0120] Figure 2 A schematic flow chart of another lightweight homomorphic encryption method provided by an embodiment of the present invention. As an example but not a limitation, method 200 may include steps S201-S203. Each step is described below.

[0121] S201: Determine a private key and a first public parameter according to a private key parameter.

[0122] S202: Based on the public key and the first public parameter, asymmetric encryption is performed on the plaintext data through a second encryption model to obtain ciphertext data corresponding to the plaintext data.

[0123] In a possible implementation, the public key can be determined based on the first encryption model, the private key and the first public parameter. Then, the plaintext data is asymmetrically encrypted based on the public key and the first public parameter through the second encryption model to obtain the ciphertext data corresponding to the plaintext data.

[0124] Exemplary public keys may include a first public key, a second public key, and a third public key.

[0125] In one example, two 0s and one 1 may be input into the first encryption model to obtain a first public key E(0)1, a second public key E(0)2, and a third public key E(1).

[0126] Exemplarily, the second encryption model may satisfy the following formula:

[0127] E(m)=(m·E(1)+r1·E(0)1+r2·E(0)2)mod N

[0128] Among them, m is plaintext data, E(m) is ciphertext data, E(0)1 is the first public key, E(0)2 is the second public key, E(1) is the third public key, N is the first public parameter, and r1 and r2 are two random numbers.

[0129] For example, r1 and r2 both belong to That is, r1 and r2 can be two randomly selected bits with a length of the fifth length parameter k. r A random number, and each bit is either 0 or 1.

[0130] In one example, the asymmetric encryption algorithm can be formally defined as: (E(m), d) = asymmetric encryption (m, pk). Where m is the plaintext data in the asymmetric encryption, pk is the public key, E(m) is the ciphertext data in the asymmetric encryption, and d is the exponent of the first private key.

[0131] Similarly, the exponent of the first private key of the ciphertext data obtained by asymmetric encryption is also 1.

[0132] S203, performing homomorphic operation on the data to be operated to obtain homomorphic encrypted data.

[0133] Optionally, method 200 may further include step S204.

[0134] S204, sending the private key and the homomorphically encrypted data to the receiving end, so that the receiving end decrypts the homomorphically encrypted data through the first decryption model according to the private key and the first public parameter to obtain the homomorphically decrypted data.

[0135] Step S201 and steps S203 - S204 of method 200 are the same as steps S101 and S103 - S104 in method 100 . For details, please refer to the relevant contents of steps S101 and S103 - S104 in method 100 , which will not be repeated here.

[0136] According to the method provided by the present invention, the plaintext data is encrypted by the first encryption model or the second encryption model to obtain the ciphertext data, and the homomorphic encrypted data can be decrypted to obtain the corresponding plaintext data after the homomorphic operation is performed, thereby realizing mixed homomorphic operation; since the present invention can directly perform homomorphic operation on the ciphertext data and the plaintext data, it is not necessary to realize the homomorphic operation through a complex operation process, so the efficiency of the homomorphic operation can be realized; since the present invention only involves multiplication, addition and modular operation on integers, compared with the matrix, data splitting and other operations of other schemes, the calculation cost can be reduced, thereby realizing efficient and lightweight encryption, homomorphic operation and decryption. Furthermore, only one additional inverse operation is required for decryption. Since the first private key is fixed, the decryptor can calculate the relevant inverse of the first private key in advance, which is equivalent to only involving one multiplication and three modular operations, which can simplify the operation process and improve the efficiency of data processing.

[0137] Figure 3 A schematic diagram of a lightweight homomorphic encryption method provided by an embodiment of the present invention. As an example but not a limitation, method 300 may include steps S301-S304. Each step is described below.

[0138] S301: Determine a private key and a first public parameter according to a private key parameter.

[0139] Step S301 of method 300 is the same as step S101 of method 100. For details, please refer to the relevant content of step S101 of method 100, which will not be repeated here.

[0140] S302, perform symmetrical or asymmetrical encryption on the plaintext data to obtain ciphertext data corresponding to the plaintext data.

[0141] In an example, the plaintext data may be symmetrically encrypted using a first encryption model according to a private key and a first public parameter to obtain ciphertext data corresponding to the plaintext data.

[0142] Exemplarily, the relevant content of symmetrically encrypting the plaintext data according to the first encryption model is the same as step S102 in method 100. For details, please refer to the relevant description of step S102 in method 100, which will not be repeated here.

[0143] In another example, the plaintext data may be asymmetrically encrypted using the second encryption model according to the public key and the first public parameter to obtain ciphertext data corresponding to the plaintext data.

[0144] Exemplarily, the relevant content of symmetrically encrypting the plaintext data according to the first encryption model is the same as step S202 in method 200. For details, please refer to the relevant description of step S202 in method 200, which will not be repeated here.

[0145] S303, performing homomorphic operation on the data to be operated to obtain homomorphic encrypted data.

[0146] S304, sending the private key and the homomorphically encrypted data to the receiving end, so that the receiving end decrypts the homomorphically encrypted data through the first decryption model according to the private key and the first public parameter to obtain the homomorphically decrypted data.

[0147] Steps S303-S304 of method 300 are the same as steps S103-S104 in method 100. For details, please refer to the relevant content of steps S103-S104 in method 100, which will not be repeated here.

[0148] According to the method provided by the present invention, the plaintext data is encrypted by the first encryption model or the second encryption model to obtain the ciphertext data, and the homomorphic encrypted data can be decrypted to obtain the corresponding plaintext data after the homomorphic operation is performed, so as to realize the mixed homomorphic operation; since the present invention can directly perform homomorphic operation on the ciphertext data and the plaintext data, it is not necessary to realize the homomorphic operation through a complex operation process, so the efficiency of the homomorphic operation can be realized; since the present invention only involves multiplication, addition and modular operation on integers, compared with the matrix, data splitting and other operations of other schemes, the calculation cost can be reduced, thereby realizing efficient and lightweight encryption, homomorphic operation and decryption. Further, only one additional inverse operation is required for decryption. Since the first private key is fixed, the decryptor can calculate the relevant inverse element of the first private key in advance, which is equivalent to only involving one multiplication and three modular operations, which can simplify the operation process and improve the efficiency of data processing. At the same time, the method provided by the present invention can realize both symmetric encryption and asymmetric encryption, and can expand the application scenario.

[0149] Figure 4 The structure diagram of a lightweight homomorphic encryption device provided by an embodiment of the present invention is shown. As an example but not a limitation, the device 400 may include a processing unit 410.

[0150] The processing unit 410 may be used to:

[0151] Determine the private key and the first public parameter according to the private key parameter;

[0152] Based on the private key and the first public parameter, the plaintext data is symmetrically encrypted using a first encryption model to obtain ciphertext data corresponding to the plaintext data;

[0153] or performing asymmetrical encryption on the plaintext data through a second encryption model based on the public key and the first public parameter to obtain ciphertext data;

[0154] Perform homomorphic operations on the data to be operated to obtain homomorphic encrypted data.

[0155] Exemplarily, the private key parameter, the private key and the first public parameter are all integers.

[0156] Exemplarily, the data to be calculated includes one or more of the following: ciphertext data, plaintext data, and homomorphic encrypted data obtained before performing the homomorphic calculation.

[0157] Exemplarily, the homomorphic operation includes an addition operation and / or a multiplication operation.

[0158] Exemplarily, decrypting homomorphically encrypted data can obtain homomorphically decrypted data.

[0159] Exemplarily, the homomorphic decrypted data is the result of performing a homomorphic operation on the plaintext data corresponding to the data to be operated.

[0160] In a possible implementation, the first encryption model may satisfy the following formula:

[0161] E(m)=s·(r·L+m)(1+r′·p)mod N

[0162] Among them, m is plaintext data, E(m) is ciphertext data, r is the first random number, r′ is the second random number, s is the first private key, L is the second private key, p is the third private key, N is the first public parameter, and mod is the modular operation.

[0163] In a possible implementation, the private key parameters may include: a first length parameter k0 and a second length parameter k L The processing unit can be specifically used to randomly select a prime number whose bit length is the first length parameter k0 to obtain a first integer; randomly select a prime number whose bit length is the first length parameter k0 to obtain a third private key; determine the product of the first integer and the third private key as the first public parameter; and randomly select an integer to obtain the first private key.

[0164] Exemplarily, the bit length of the first private key is the same as the first public parameter, and the first private key is smaller than the first public parameter.

[0165] In a possible implementation, the public key may include a first public key, a second public key, and a third public key, and the processing unit may be further configured to input two 0s into the first encryption model to obtain the first public key and the second public key, and input 1 into the first encryption model to obtain the third public key.

[0166] In a possible implementation, the second encryption model may satisfy the following formula:

[0167] E(m)=(m·E(1)+r1·E(0)1+r2·E(0)2)mod N

[0168] Among them, m is plaintext data, E(m) is ciphertext data, E(0)1 is the first public key, E(0)2 is the second public key, E(1) is the third public key, N is the first public parameter, and r1 and r2 are two random numbers.

[0169] In a possible implementation, the device 400 may further include a sending unit 420. The sending unit may be used to send a private key and homomorphically encrypted data to a receiving end, so that the receiving end decrypts the homomorphically encrypted data through a first decryption model according to the private key and the first public parameter to obtain homomorphically decrypted data.

[0170] Exemplarily, the first decryption model satisfies the following formula:

[0171] m′=(((s d ) -1 E(m)mod N)mod p)mod L

[0172]

[0173] Where m is the homomorphic decrypted data, E(m) is the homomorphic encrypted data, r is the first random number, r′ is the second random number, s is the first private key, L is the second private key, p is the third private key, N is the first public parameter, (s d ) -1 For d The inverse element of , d is the exponent of the first private key.

[0174] In one possible implementation, if the homomorphic operation includes an addition operation, the exponent of the first private key of the homomorphically encrypted data is the maximum exponent of the first private keys of all summed items; if the homomorphic operation only includes a multiplication operation, the exponent of the first private key of the homomorphically encrypted data is the sum of the exponents of the first private keys of all multiplied data to be operated.

[0175] According to the method provided by the present invention, the plaintext data is encrypted by the first encryption model or the second encryption model to obtain the ciphertext data, and the homomorphic encrypted data can be decrypted to obtain the corresponding plaintext data after the homomorphic operation is performed, so as to realize the mixed homomorphic operation; since the present invention can directly perform homomorphic operation on the ciphertext data and the plaintext data, it is not necessary to realize the homomorphic operation through a complex operation process, so the efficiency of the homomorphic operation can be realized; since the present invention only involves multiplication, addition and modular operation on integers, compared with the matrix, data splitting and other operations of other schemes, the calculation cost can be reduced, thereby realizing efficient and lightweight encryption, homomorphic operation and decryption. Further, only one additional inverse operation is required for decryption. Since the first private key is fixed, the decryptor can calculate the relevant inverse element of the first private key in advance, which is equivalent to only involving one multiplication and three modular operations, which can simplify the operation process and improve the efficiency of data processing. At the same time, the method provided by the present invention can realize both symmetric encryption and asymmetric encryption, and can expand the application scenario.

[0176] Figure 5 FIG. 1 is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. Figure 5 The electronic device 500 shown may include: at least one processor 510 ( Figure 5 Only one processor is shown in the figure), a memory 520, and a computer program 530 stored in the memory 520 and executable on the at least one processor 510, wherein the processor 510 implements the steps of any of the above-mentioned method embodiments when executing the computer program 530.

[0177] The electronic device 500 may be a processing device such as a robot that can implement the above method. The embodiment of the present invention does not impose any limitation on the specific type of the electronic device.

[0178] Those skilled in the art will understand that Figure 5 The electronic device 500 is merely an example and does not constitute a limitation on the electronic device. The electronic device 500 may include more or fewer components than shown in the figure, or may combine certain components, or may include different components. For example, the electronic device 500 may also include an input and output interface.

[0179] The processor 510 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASTC), field programmable gate arrays (FPGA), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0180] The memory 520 may be an internal storage unit in some embodiments, such as a hard disk or a memory. The memory 520 may also be an external storage device in other embodiments, such as a plug-in hard disk, a smart memory card (SmartMemory Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. Further, the memory 520 may also include both an internal storage unit and an external storage device. The memory 520 is used to store an operating system, an application program, a boot loader (Boot Loader), data, and other programs, such as the program code of the computer program, etc. The memory 520 may also be used to temporarily store data that has been output or is to be output.

[0181] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0182] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0183] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0184] An embodiment of the present invention provides a computer program product. When the computer program product runs on an electronic device, the electronic device can implement the steps in the above-mentioned method embodiments when executing the computer program product.

[0185] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of the above-mentioned various method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium can at least include: any entity or device that can carry the computer program code to the camera / terminal device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), electric carrier signal, telecommunication signal and software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0186] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0187] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0188] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0189] In the above embodiments, the description of each embodiment has its own emphasis. For the part that is not described or recorded in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

Claims

1. A lightweight homomorphic encryption method for implementing symmetric encryption and asymmetric encryption, characterized in that: The method comprises: Determine a private key and a first public parameter according to a private key parameter, wherein the private key parameter, the private key and the first public parameter are all integers; Based on the private key and the first public parameter, the plaintext data is symmetrically encrypted using a first encryption model to obtain ciphertext data corresponding to the plaintext data; Wherein, the private key includes a first private key, a second private key and a third private key; The first encryption model satisfies the following formula: E(m)=s·(r·L+m)(1+r′·p)mod N Wherein, m is the plaintext data, E(m) is the ciphertext data, r is the first random number, r′ is the second random number, s is the first private key, L is the second private key, p is the third private key, N is the first public parameter, and mod is a modulus operation; or performing asymmetrical encryption on the plaintext data through a second encryption model based on the public key and the first public parameter to obtain the ciphertext data; The public keys include: a first public key, a second public key and a third public key; The second encryption model satisfies the following formula: E(m)=(m·E(1)+r1·E(0)1+r2·E(0)2)mod N Wherein, m is the plaintext data, E(m) is the ciphertext data, E(0)1 is the first public key, E(0)2 is the second public key, E(1) is the third public key, N is the first public parameter, and r1 and r2 are two random numbers; Performing a homomorphic operation on the data to be operated to obtain homomorphically encrypted data, wherein the data to be operated includes one or more of the following: the ciphertext data, the plaintext data, the homomorphic encrypted data obtained before performing this homomorphic calculation, the homomorphic operation includes an addition operation and / or a multiplication operation, and decrypting the homomorphic encrypted data can obtain homomorphic decrypted data, and the homomorphic decrypted data is a result of performing the homomorphic operation on the plaintext data corresponding to the data to be operated.

2. The method according to claim 1, characterized in that: The private key parameters include: a first length parameter k0 and a second length parameter k L ; The step of determining the private key and the first public parameter according to the private key parameter includes: Randomly select a prime number whose bit length is the first length parameter k0 to obtain a first integer; Randomly select a prime number whose bit length is the first length parameter k0 to obtain the third private key; determining a product of the first integer and the third private key as the first public parameter; Randomly select an integer to obtain the first private key, wherein the bit length of the first private key is the same as the first public parameter, and the first private key is smaller than the first public parameter; Randomly select a bit length as the second length parameter k L An integer is obtained to obtain the second private key.

3. The method according to claim 1, characterized in that The first public key and the second public key are obtained by inputting two zeros into the first encryption model respectively; The third public key is obtained by inputting 1 into the first encryption model.

4. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: Sending the private key and the homomorphically encrypted data to a receiving end, so that the receiving end decrypts the homomorphically encrypted data through a first decryption model according to the private key and the first public parameter to obtain the homomorphically decrypted data; The first decryption model satisfies the following formula: m′=(((s d ) -1 ·E(m)modN)modp)modL Wherein, m is the homomorphic decrypted data, E(m) is the homomorphic encrypted data, s is the first private key, L is the second private key, p is the third private key, N is the first public parameter, (s d ) -1 For d , d is the exponent of the first private key of the homomorphically encrypted data.

5. The method according to claim 4, characterized in that If the homomorphic operation includes an addition operation, the exponent of the first private key of the homomorphically encrypted data is the maximum exponent of the first private key of all sums; If the homomorphic operation only includes multiplication operation, then the exponent of the first private key of the homomorphically encrypted data is the sum of the exponents of all multiplied first private keys of the data to be operated.

6. A lightweight homomorphic encryption device for implementing symmetric encryption and asymmetric encryption, characterized in that: The apparatus comprises a processing unit, wherein the processing unit is configured to: Determine a private key and a first public parameter according to a private key parameter, wherein the private key parameter, the private key and the first public parameter are all integers; Based on the private key and the first public parameter, the plaintext data is symmetrically encrypted by a first encryption model to obtain ciphertext data corresponding to the plaintext data; Wherein, the private key includes a first private key, a second private key and a third private key; The first encryption model satisfies the following formula: E(m)=s·(r·L+m)(1+r′·p)mod N Wherein, m is the plaintext data, E(m) is the ciphertext data, r is the first random number, r′ is the second random number, s is the first private key, L is the second private key, p is the third private key, N is the first public parameter, and mod is a modulus operation; or performing asymmetrical encryption on the plaintext data through a second encryption model based on the public key and the first public parameter to obtain the ciphertext data; The public keys include: a first public key, a second public key and a third public key; The second encryption model satisfies the following formula: E(m)=(m·E(1)+r1·E(0)1+r2·E(0)2)mod N Wherein, m is the plaintext data, E(m) is the ciphertext data, E(0)1 is the first public key, E(0)2 is the second public key, E(1) is the third public key, N is the first public parameter, and r1 and r2 are two random numbers; Performing a homomorphic operation on the data to be operated to obtain homomorphically encrypted data, wherein the data to be operated includes one or more of the following: the ciphertext data, the plaintext data, the homomorphic encrypted data obtained before performing this homomorphic calculation, the homomorphic operation includes an addition operation and / or a multiplication operation, and decrypting the homomorphic encrypted data can obtain homomorphic decrypted data, and the homomorphic decrypted data is a result of performing the homomorphic operation on the plaintext data corresponding to the data to be operated.

7. An electronic device comprising a memory, a processor and a computer program stored in the memory, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images